Itheneli ehlukanisiwe ayikhululi ihost yomphakathi emishibeni ye-NAT ye-ASA

Itheneli ehlukanisiwe ivame ukuchazwa njengendlela yokugcina ithrafiki yenkampani ngaphakathi kwetheneli kanti enye i-inthanethi ingaphandle kwe-firewall. Zombili izingxenye zaleyo ncazelo zinephutha ngendlela efanayo. Itheneli ehlukanisiwe isinqumo somzila esithathwa yiklayenti, futhi isinqumo somzila asisho lutho mayelana nokwenzeka kupakethe ngemva kokufika kwi-headend.

Isevisi eyodwa yozakwethu ekhelini lomphakathi, ephikelela ekuboneni ikheli lendlu yakho enkulu, yanele ukuwisa le ndaba.

Inganekwane: itheneli ehlukanisiwe isusa i-firewall emzileni

Inkolelo iwukuthi noma yimuphi umkhombandlela ongaphandle kwebanga langasese uhlala kuxhumano lwe-inthanethi lwasekhaya, ngakho i-firewall ayiwuboni neze futhi ayidingi umthetho ngawo. Lokho kuyiqiniso kuphela uma umkhombandlela ungekho ohlwini lwetheheneli. Ngesikhathi umqhubi engeza ihost yomphakathi ku-ACL ye-split-include, iklayenti lihambisa leyo thrafiki ngaphakathi kwetheneli, futhi i-ASA kufanele iyihambise, iyihlungise futhi iyihumushe njenganoma yikuphi okunye ukugeleza okususiwe. Kuklayenti akukho okunye okushintshile ngaphandle kohlu lwemikhombandlela.

Iklayenti alizange libe umhambisi. Lalilanda inqubomgomo oyinikezile.

Umzila we-split-include wenzani ngempela

Ekuhlelweni kokufinyelela kude kwe-Cisco ASA, inqubomgomo yeqembu iphethe split-tunnel-policy tunnelspecified kanye ne-split-tunnel-network-list ebiza i-ACL ejwayelekile. Wonke umugqa we-permit kuleyo ACL uyindawo okufanele iklayenti liyithumele ethenelini, futhi konke okunye kuqhubeka kusebenzisa umzila ozenzakalelayo wasekhaya.

Ukungeza ihost eyodwa umugqa owodwa, futhi yiyo kuphela ingxenye yoshintsho iklayenti elingayibona: access-list RA-SPLIT standard permit host 203.0.113.20.

Ngemva kwalokho xhuma iklayenti futhi. Inqubomgomo ishintshaniswa ngesikhathi sokuxhumana, ngakho iseshini esivele isungulwe igcina uhlu oludala futhi yenza ushintsho lubonakale sengathi akenzanga lutho.

Ipakethe lingena futhi liphuma ku-interface efanayo

Manje landela ukugeleza ngemva kokususwa. Ipakethe langena ku-interface yangaphandle ngemetheneli ye-VPN, indawo yalo iyikheli lomphakathi, futhi ithebula lomzila liyiphindisela ngaphandle ngaleyo interface yangaphandle iya e-inthanethi. Ithrafiki engena futhi ephuma ku-interface eyodwa iyalahlwa ngaphandle uma i-ASA ivunyelwe, futhi yilokho okwenziwa yi-same-security-traffic permit intra-interface. Ngaphandle kwalokho uxhumano luhluleka ngendlela ebukeka njengenkinga yomzila kodwa engeyona.

Leso silungiselelo sisonke. Sivumela i-hairpinning kukho konke ukugeleza okudinga, hhayi kuphela le host yozakwethu, ngakho siyingxenye yoshintsho olubuyekeziwe hhayi lokuhlola okusheshayo.

Kungani i-PAT ekhawulelwe endaweni ingeyona yokuzikhethela

Ikheli lomthombo epaketheni elisusiwe liseyikheli le-VPN leklayenti, ngokuvamile lisuka echibini elifana ne-10.77.0.0/24. Lelo kheli alinawo umzila ku-inthanethi yomphakathi, ngakho uzakwethu kungenzeka angaphenduli neze noma aphendule endaweni engekho.

Ukuhumusha kulungisa umthombo futhi kushiya indawo ingathintwanga. Njengoba izinto sezivele zichaziwe kwenye indawo, umthetho wesandla okhawulelwe kule ndawo unalesi simo:

same-security-traffic permit intra-interface

object network RA_POOL
 subnet 10.77.0.0 255.255.255.0
object network PARTNER_HOST
 host 203.0.113.20

nat (outside,outside) source dynamic RA_POOL interface destination static PARTNER_HOST PARTNER_HOST

Ingxenye ye-destination static ibalulekile. Uma uyishiya, umthetho uba ukuhumusha okubanzi okungase kuhambisane nethrafiki eningi kakhulu kunalokho obekuhlosiwe, futhi umthetho we-identity obanzi oseduze ekuqaleni kohlelo ungawunqoba ngokuphelele. Hlola i-show nat detail nokuhleleka kwezigaba ngaphambi kokucabanga ukuthi umthetho wakho yiwo ohambisanayo.

I-PAT ye-interface isho futhi ukuthi uzakwethu ubona ikheli le-interface ye-ASA, elingase lihunyushwe futhi phezulu. Uma inkontileka isho ikheli, liqinisekise kusukela ekuqaleni kuze kube sekupheleni hhayi ngokugxuma okukodwa.

Kufakazele ngendawo yokuhlola efanele

Sebenzisa ihost yozakwethu uqobo, hhayi ikhasi elijwayelekile le-what-is-my-ip. Lelo khasi licishe libe ngaphandle kohlu lwe-split, ngakho libika ikheli lakho le-inthanethi lasekhaya futhi alisho lutho ngalo mzila. Vula uxhumano olusha enkonzweni yozakwethu bese ubuza ukuthi yimuphi umthombo abawubonile, noma sebenzisa i-packet-tracer input outside tcp 10.77.0.10 12345 203.0.113.20 443 detailed bese ufunda izigaba ze-NAT nezomzila umugqa ngomugqa. I-traceroute evela kuklayenti iwukuhlola okubuthakathaka, ngoba ikhombisa umzila osekwenzekile hhayi inqubomgomo ewukhethile.

Bese uhlola ukuthi yini okungafanele ishintshe. Iwebhusayithi ejwayelekile kumele isaphuma ngoxhumano lwasekhaya, futhi isisetshenziswa sangasese esisohlwini lwetheheneli kumele sisafinyeleleka. Ushintsho olulungisa uzakwethu futhi lwehlukanisa okukodwa kwalokho kuwukungqubuzana okunye.

Inguqulo esebenzayo yalo mklamo imfishane: ihost eyodwa ku-ACL ye-split, imvume ye-hairpin, umthetho we-PAT owodwa okhawulelwe endaweni. Konke okunye endabeni kuyinganekwane.